# AI Agents Automate Large-Scale Cyberattacks on Global Corporate Websites Hackers leverage open-source AI platforms to breach over 100 corporate sites efficiently. - **Source:** [The Next Web](https://brifing.si/source/afe24b20-b275-4c19-b9a6-8bb3c8babae7) - **Published:** 2026-10-19 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/89a24afe-787f-4834-84d6-c8d21aa24cfe ## Automated Breach Campaign A Chinese-speaking hacker utilized the open-source platform Cairn to automate intrusions into over 100 corporate websites. Principal threat researcher Snorre Fagerland of NorForge identified the campaign, which began on September 25. The attacks targeted diverse entities, including Deere, SharkNinja, and Cummins, by deploying AI agents to execute complex exploitation tasks. ## Cairn Platform Mechanics Cairn functions as an AI problem-solving architecture where human operators define targets and goals. Agents operate on a shared board, reading findings and receiving hints to progress step-by-step. Many operators left these control panels exposed on the public web, allowing NorForge to discover them using standard internet scanning tools starting October 2. ## Targeting and Methodology The primary malicious cluster executed over 1,100 attack projects across 14 panels. Agents targeted online shops in the US, Canada, Japan, and Australia with significant traffic volumes. The automated pipeline instructed agents to find code execution vulnerabilities and plant uploader web shells, aiming for persistent access to payment and shop systems. ## Model and Cost Efficiency Tasks reportedly ran on a worker identified as claudecode_deepseek-v4.1-flash, combining Anthropic’s Claude Code with DeepSeek’s low-cost V4.1 Flash model. Successful attacks required approximately 23 hours of processing time. NorForge estimates the campaign cost roughly $5,000 in tokens, averaging about $50 per successful hack, though individual task costs averaged around $5. ## Vulnerability Discovery Process When agents failed to find flaws in public-facing applications, they systematically hunted for linked control panels. Through hours of trial and error, they eventually tricked servers into executing commands. NorForge observed an approximate 10% success rate across the monitored tools, noting that different clusters pursued distinct goals ranging from credential theft to cryptocurrency. ## Exposed Sensitive Credentials The open control panels inadvertently leaked hundreds of credentials and API keys. Using the scanner Trufflehog, NorForge verified that 11% of these exposed secrets were valid. The issue extended beyond malicious actors, as some legitimate security testing firms also left client work exposed in the same insecure manner on the public web. ## Platform Author Response The author of Cairn, posting as le1xia0 on X, stated that the multi-agent architecture was not designed for hacking purposes. They explicitly disavowed the malicious use of their software. Meanwhile, NorForge is collaborating with Reuters to notify affected victims and is actively requesting hosting firms to take down the exposed control panels. ## Broader Industry Implications This incident follows reports from Gambit Security regarding AI agents stealing 600,000 credit card records. Previous government warnings from Taiwan and India highlight a growing trend of AI-assisted cyber threats. Snorre Fagerland noted that the speed of development in this field is astounding, surpassing previous assumptions regarding the necessity of human supervision. ## Sources covering this story - https://thenextweb.com/news/ai-agents-hacker-cairn-100-sites-deere-norforge — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._